# 3.17.5 Release Notes Squirro 3.17.5 was released on November 12, 2026. Learn more about the [Squirro Release Process](../squirro-release-process.md#getting-squirro-process). > **Notes for administrators** > > This release introduces important changes that may require adjustments to your existing setup. [Learn more](#breaking-changes) Release summary Squirro Neo can answer a search directly: an AI Overview above the results cites its sources, and users can continue it as a chat. It is on in every project after the upgrade. The Neo interface can be offered in Arabic, with a right-to-left layout, and each project chooses the interface languages its users see. Users can manage their profile, switch to a dark theme, and find their templates and files in one place in the Neo settings. Through the RheinInsights connector, projects can enforce the security clearances of documents from OpenText Content Server with Records Management, so users see only the documents they are cleared for. Customers who use RheinInsights sources, set a reasoning effort for Squirro Chat, customized the web server settings of Studio, or built a custom Neo interface or embedded Neo in their own site need to update their setup as part of the upgrade. ## What’s New - **AI Overview in Neo search** Above the search results, a short, cited answer that users can continue as a chat. On by default in every project, at one model call per answered search. - **Arabic in Neo, with a right-to-left layout** Arabic interface for projects that list it in `frontend.languages`, with a mirrored layout. The same setting controls which languages Neo offers. - **Profile, appearance, templates, and files in Neo settings** Profile, language, and a dark theme in Neo settings. New Templates and Library sections replace the Template Manager and the file management dialog. ## Improvements ### Neo Interface - Prompt before unsaved changes are discarded in Neo settings, the Memory entry dialog, and the template form. - Widgets in Neo answers placed where the answer text refers to them, including in copies, exports, and reloaded conversations. - Open and Copy link actions on the rows of the Neo sources panel. - Neo document details opening at the cited page and scrolling to the cited passage. - Origin label on Neo conversations started from search, listing the search filters on hover. - Translated titles and summaries of models and assistants in the Neo pickers, when the catalog provides them. - Document summaries in Neo streamed as they are generated, and stopped on the instance when canceled or regenerated. - Inter font served by the Neo web client, with no requests to Google Fonts. - Search text and summary prompts left out of the request logs of the Neo web client server. - Security hardening of Neo DOCX exports. ### Neo Agent Configuration - `overview` settings of Neo projects: `enabled`, `grounding_threshold`, and `max_sources`. - `ai-overview` agent, whose instructions replace the default AI Overview instructions when authored. ### Neo UI CLI - Component catalog shipped with `@squirro/neo-core`, served offline by `neo-ui catalog` from the installed core of the bundle. - Token prompts and hints of `neo-ui create bundle`, `neo-ui deploy`, and `neo-ui projects` saying where Neo generates the token. ### Neo Core Library - `upload` method of `useSquirroApi()`, posting multipart bodies with progress reporting and cancellation. - `modelPicker` and `connectorPicker` chat capabilities, showing or hiding the model and connector pickers of the Neo message box. - `side="start"` and `side="end"` on `Popover`, `Tooltip`, `DropdownMenu`, and `Select` content, following the reading direction. - `dark` theme tokens in the theme manifest, giving a custom theme its own dark-mode colors. - Batch Q&A recipe in the `squirro-chat` Claude Code skill shipped with `@squirro/neo-core`, for sending chat questions from code. ### Neo SDK - Security hardening of the Neo SDK proxy. ### Squirro Interface - Error red of the Squirro interface meeting WCAG AA contrast. - Source types of the RheinInsights wizard loaded from RheinInsights, adding types such as Exchange Online, OpenText Content Server, and Salesforce. - `[rhein_insights] request_timeout` setting in `frontend.ini` for slow connector creation in the RheinInsights wizard, 30 seconds by default. - Security hardening of item display in the Squirro interface. ### Squirro Chat Widget - Assistant settings of the Chat widget, such as the persona, saved only by project administrators and owners. ### Platform - `POST /v1/projects/{project_id}/overview` endpoint of the Neo API, streaming a cited AI Overview of a search. - `promote` endpoint of Neo conversations, keeping an AI Overview, Explain, or Translate conversation to continue it in chat. - Ephemeral Neo conversations that receive feedback kept for 30 days for evaluation, without appearing in the conversation list. - AI Overview outcomes by reason in the service logs and the `squirro.service.genai.v1.overview.requests` counter. - Faster first answer of Neo turns, with GenAI warming up for up to 10 seconds at startup before it reports healthy. - Faster Explain and Translate in Neo, which no longer generate a title or connect to external MCP servers. - `anchor` field on `output_block.ui` blocks of the Neo chat API, placing each widget where the answer text names it. - System prompt of Claude models served from the cache at the start of every Neo turn. - Lower overhead of Neo agents when LangSmith tracing is off. - Reason given for a rejected Neo tool call, now passed on to the model. - OpenAI models available only on the Responses API, such as `gpt-5*-pro` and Codex models, routed to it in Neo and Squirro Chat. - MCP connections of Neo and Squirro Chat, and their OAuth sign-in, following redirects only within the same origin. - GenAI service on the MCP SDK 2, Starlette 1, and LangChain 1.4. - `use_responses_api` option in the Azure LLM settings of Squirro Chat, sending requests through the Azure Responses API. - Revoked item permissions taking effect in Squirro Chat within 5 minutes. - `opentext_security_trimming` option of RheinInsights sources and `rhein_insights_opentext_acl` query template profile, enforcing the security clearances and supplemental markings of OpenText Content Server with Records Management. - `/studio-mcp` listing Studio plugins only, with each tool naming its plugin in `_meta`. - `topic.globaltemp.allow-reader-file-upload` letting reader accounts upload files only in projects they are members of. - Neo on RPM-based deployments reaching the legacy API through the local nginx, with `LEGACY_API_URL` defaulting to the `[services] user` origin of `common.ini`. - Elasticsearch and Filebeat 9.5.6. - Obsolete built-in Sales Insights Generation and Index Embeddings pipelets no longer installed. - Security fix of item access in Squirro Chat. - Security hardening of the GenAI service. - Security hardening of file handling. ### Containerized Deployments - Technical Preview - OpenSearch as the default search engine of containerized deployments, with Elasticsearch available through `SEARCH_ENGINE=elasticsearch`. - Technical Preview - Search engine of a deployed host kept by the `squirro_containers` Ansible role, which refuses a switch unless `squirro_allow_search_engine_switch` is `true`. ## Bug Fixes ### Neo Interface - Language added by an extension bundle lost after a reload, a new tab, or a new session in Neo. - Answer stream left running after a project switch in Neo, with Stop canceling in the wrong project. - Stream of the previous Neo conversation left running when opening a conversation whose first turn was still generating. - Follow-up sent right after switching Neo answer versions answered on the version the user left. - Regenerate or Edit refused by Neo replacing the original answer with an empty bubble. - Regenerate and Edit in Neo starting while a message was still being sent, and a message sent twice after leaving and reselecting its conversation. - Neo chat stream ending with a server error also reported as complete, hiding the error. - Failed agent or tool lists in Neo showing no agents for 5 minutes instead of an error. - Templates submenu of the Neo message box showing “No templates available” for 5 minutes after a failed read. - Open feedback dialog, Copied state, and question editor in Neo closing when a turn finished. - Legacy project settings URLs always opening Neo settings over the chat, instead of over the landing page of the project. - Document summaries failing with a 403 error for users signed in to Neo only. - Keyboard and screen reader issues in Neo, including arrow keys not moving between tabs of the artifact viewer and export and token outcomes announced twice. ### Neo Agent Configuration - Neo Azure models with `use_responses_api: true` in `backend_kwargs` ignoring the reasoning effort of the project and the assistant. - MCP servers switched on or off for a Neo turn not applying to the subagents it hands work to. - Main Neo assistant passing its preferences to subagents as user settings, and resumed, regenerated, or edited answers ignoring the settings of the original turn. ### Neo UI CLI - `.env.example` of new bundles setting the development ports of the Neo host instead of the `neo-ui` defaults. - `neo-ui` printing a `DEP0190` deprecation warning on Node.js 24. - `neo-ui create bundle` exiting successfully without creating anything, when run without a terminal and a default port was in use. - Canceled `neo-ui create bundle` leaving a half-written bundle behind, including the `.env` file with the API token. - New bundles not ignoring `.claude/skills/*/reference/_local/` in Git. - `neo-ui upgrade` leaving behind skill files that the installed `@squirro/neo-core` no longer ships. ### Neo SDK - Neo SDK third-party notices missing the license of the Babel helpers bundled with DOMPurify. ### Squirro Interface - Dashboard editor closed to readers with an edit grant on a restricted dashboard, and Edit, Delete, and Duplicate offered to users who cannot use them. - Widget crashing when closing the item detail of an item whose body is a full HTML document. - NER labels saved at the wrong offsets after an in-body style or an SVG tooltip. - NER Fast Pass showing no message when accepting, rejecting, or creating a label failed without a response body. - German, French, and Italian interfaces showing 16 strings in English, or raw translation IDs such as `home:heroSummary`. - Style rules accumulating in the page as items, popups, and long lists were used, increasing memory use over long sessions. - Project colors overwriting the default theme, and projects without theme settings failing to load their theme. - Duplicated data source showing the item count and last run of the original source. - Project members and administrators with the Restricted workspace role or the Reader server role unable to upload files when creating a File data source. - File uploads failing with a 500 error on malformed request parameters, and `parse_communities=false` treated as true. - First query dropped when pressing Enter twice quickly in the search bar. - RheinInsights source crawling the wrong connector when the wizard was given another connector ID or was open in two tabs. - RheinInsights wizard showing “No editable fields” for nested blocks, such as the Active Directory configuration of a SharePoint on-premise connector. - RheinInsights wizard hiding validation errors from nested blocks, and the error message from RheinInsights when no field explained the issue. - RheinInsights wizard failing when RheinInsights created a connector after a timeout. ### Squirro Chat Widget - Stopped Chat answer coming back in full after a reload, or with its question shown twice. - Renaming, rating, or stopping a Chat conversation deleting its uploaded files and model history. - Stopping a Chat answer not working when a browser extension, such as Jam, wraps the network requests of the page. - Chat accepting unsupported file types, such as PNG and JPEG, without telling the user which files were not uploaded. - Chat widget showing an empty AI notice when its disclaimer text contained only blank characters. - Chat input taking focus from the global search, or from fields in embedded frames, while the user typed or when an answer ended. - Chat widget staying on its loader when the preferences request failed. - Project configuration dialog of the Chat widget closing before its settings were saved, and able to overwrite the stored persona with an empty form. - Long assistant persona instructions, or instructions with non-ASCII text such as German, failing to save. ### Platform - Neo overstating how many documents a data source holds, also on projects that sample aggregations. - Stopped Neo agent briefly shown as ended with its result still pending, on PostgreSQL, SQLite, and MariaDB or MySQL set to READ COMMITTED. - One MCP tool with a regular expression pattern that OpenAI cannot run breaking every Neo turn on OpenAI models. - Neo on RPM-based deployments failing to load the project list when the instance certificate comes from an internal CA. - GenAI on RPM-based deployments not trusting CA certificates added to the host, such as for internal LLM endpoints or MCP servers. - Item that Squirro Chat once failed to read staying unavailable until the service restarted. - Requests such as project creation failing at random on services run by gunicorn, after the search engine dropped a shared connection. - Background processes, such as the KEE process of Studio, left running when a gunicorn worker was recycled. - User and topic proxy services deadlocking on gunicorn when each called the other at the same time. - Studio service hanging until restarted under sustained heavy load. - `/studio-mcp` refusing Studio tools with a project permission, the default, and not honoring the project of the call. - Item bodies starting with plain text losing their leading paragraph since 3.17.4, affecting Noise Removal and the item view, with stored items needing re-ingestion. - Paragraph labels keeping their values from creation when an item was indexed again without new content, such as after a permission change. - AutoML training failing with `'XGBClassifier' object has no attribute 'n_classes_'`. - Pushing items through the API storing none of them when the file content of one item was not valid base64. - Deletions skipped, and failed rows not retried, when the Transform Input step could not transform the rows of a batch. - Ingester logging successful items at ERROR level when other items of the same batch ran out of retries. - `DELETE /v0/{tenant}/pipelets` returning 204 without deleting any pipelet, now leaving built-in pipelets in place. - `datetime.utcnow()` deprecation warning repeating in the service logs. - RheinInsights users removed in the source keeping access when their email address has capital letters. - RheinInsights users with IDs that are not email addresses and contain capital letters, such as Entra IDs, not seeing the documents their ACL grants. - RheinInsights preview starting a full scan of the source. - RheinInsights batch ingestion triggering crawls, and scheduled loads skipping content files when `item_transformation_in_pipeline` is off. - RheinInsights runs finishing as completed when they could not read the crawl files or store the ACL data. ### Containerized Deployments - Technical Preview - Log shipper image of containerized deployments losing log records after a restart. - Technical Preview - Query Understanding failing to load in containerized deployments. ## Breaking Changes ### Neo Core Library - A custom Neo interface that builds `ChatStrings` in full fails to compile against this release of `@squirro/neo-core` until it adds eight keys: `composerMenuLabelWithoutConnectors`, `composerMenuLabelWithoutFiles`, `composerMenuLabelCapabilitiesOnly`, `answerSourcesCount`, `answerShowSources`, `answerRegenerateOverview`, `originFromSearch`, and `originFromSearchWithFilters`. Add the keys, or pass a partial set instead. - `getTemplates` and `getAgents` of `ChatDataSource` reject with a `ChatRequestError` on an error response or an empty body, instead of resolving an empty list. Handle the rejection in custom code. - A bundle built with this release of `@squirro/neo-core` needs a Squirro server of the same release or later, or its menus, selects, tabs, and other Radix components fail to load. Upgrade the server before deploying a rebuilt bundle. ### Neo SDK - The Neo SDK hides the Connectors submenu of the message box, and each switch in `capabilities` takes only `true` or `false`. Pass only `true` or `false` in `capabilities`. Setting `connectorPicker` to `true` shows the submenu, but Connect and Disconnect fail through the SDK proxy. ### Platform - Neo approvals still pending when the upgrade runs expire, and answering one ends the turn with an `interrupt_expired` failure. Before upgrading, ask users to answer pending approvals, including deferred approvals of scheduled tasks, and afterwards to send expired requests again. - Squirro Chat sends an explicitly configured `reasoning_effort` to Azure deployments, which earlier releases never did. Before upgrading, remove `reasoning_effort` from `genai.sqgpt.default-settings` and from the `genai.sqgpt.settings` of each project for Azure deployments of non-reasoning models, such as gpt-4o, and of non-OpenAI models. Where an Azure deployment keeps `reasoning_effort`, set `openai_api_version` to a version that supports it. For gpt-5.4 and later models, unset the effort before upgrading, then turn on `use_responses_api` and set the effort again after the upgrade. Otherwise the provider rejects every chat request of the affected projects. - Squirro Chat sends a `reasoning_effort` of `none` instead of treating it as unset. Where `none` was set to turn reasoning off on OpenAI o-series or the original gpt-5 models, which may reject it, unset it or use `minimal`. - RheinInsights sources crawled on 3.15.3 or later need their ACL index rebuilt once, because the connector now keeps IDs that are not email addresses as received instead of in lowercase. After the upgrade, delete the `rhein_insights_users-` index of each source, with its `acl_es_index_prefix` in place of `rhein_insights_users` if it sets one, and run the source. Users see none of the documents of the source until that run has stored the ACL data. - On RPM-based deployments, the Studio service serves HTTP instead of FastCGI. The upgrade sets `web_server = gunicorn` in `/etc/squirro/studio.ini`, replaces customized `studio.conf` and `genai.conf` nginx files that still use FastCGI, keeping the old copies as `*.pre-gunicorn.`, and empties `studio-fastcgi.inc`. After the upgrade, run `nginx -t`, and re-apply customizations with `proxy_*` instead of `fastcgi_*` directives, also in other nginx files that include `studio-fastcgi.inc`. With Ansible, use the role released with 3.17.5. Otherwise Studio and data loader requests fail with a 502 error. - The upgrade removes the `squirro-nodejs` package from RPM-based deployments, which custom asset compilation no longer needs. Before upgrading, install Node.js separately for any script on the host that uses it. - Readers can no longer save the assistant settings of the Chat widget, such as the persona, or upload files in projects they are not members of, and `/studio-mcp` no longer lists data loader plugins. Check users and MCP clients that relied on them. ### Containerized Deployments - Technical Preview - Containerized deployments run OpenSearch by default, and the `docker-compose.opensearch*.yml` overlays are removed. On a deployment that runs Elasticsearch without the `squirro_containers` Ansible role, pass `SEARCH_ENGINE=elasticsearch` on every `make` call and add `docker-compose.elasticsearch.yml` to every `docker compose` command, starting with the upgrade. Otherwise the stack starts with an empty OpenSearch index. Remove the OpenSearch overlays from existing `docker compose` commands. ## Installation and Upgrade For new installations, find step-by-step instructions on the [Install and Manage Squirro with Ansible](../../install/ansible/index.md#ansible) page (recommended) and [Installing Squirro on Linux](../../install/linux.md#install-linux) pages. To upgrade an existing installation, see the [Upgrading Squirro](../../install/upgrade.md#install-upgrade) page.